huntrule

Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

Flags PowerShell Copy-Item operations targeting browser Login Data credential database paths on Windows.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-01-30
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies PowerShell script content that copies files associated with browser credential stores, including Opera, Firefox profiles, and Chromium-based Edge/Chrome Login Data files. This behavior matters because attackers can steal stored website usernames and passwords that browsers keep in credential stores. The detection relies on ScriptBlockText telemetry and matches copy commands that reference specific browser Login Data paths.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange
Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)
Malicious Edge Credential Parser Execution via PowerShell (via process_creation)
SapphireStealer Working Directory File Drop in Temp
Malicious RemusStealer Credential Exfiltration to pics TLD C2
Suspicious Local Password Validation via dscl authonly
Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)
Suspicious BoryptGrab Infostealer Staging Directory (via file_event)
Malicious Interlock Credential Stealer Output File
Malicious Browser Master Key Decryption Artifacts Written by Katz Stealer (via file_event)
Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files
Pivot detection · T1555.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.